[Duboku] Decrypt m3u8 url link

[DmitryScaletta]

Description of your pull request and other information

player_data

{
  "flag": "play",
  "encrypt": 2,
  "trysee": 0,
  "points": 0,
  "link": "/vodplay/4283-1-1.html",
  "link_next": "",
  "link_pre": "/vodplay/4283-1-31.html",
  "url": "JTY4JTc0JTc0JTcwJTczJTNBJTJGJTJGJTczJTc0JTZEJTJFJTZFJTYyJTZGJTZCJTc1JTJFJTYzJTZGJTZEJTJGJTMyJTMwJTMyJTM0JTMwJTMyJTMwJTM3JTJGJTQ0JTRDJTcxJTM0JTQyJTUxJTQ1JTVBJTJGJTY5JTZFJTY0JTY1JTc4JTJFJTZEJTMzJTc1JTM4",
  "url_next": "",
  "from": "vidjs",
  "server": "no",
  "note": "",
  "id": "4283",
  "sid": 1,
  "nid": 32
}

https://u.duboku.io/static/js/player.js

if (player_data.encrypt == "1") {
  player_data.url = unescape(player_data.url);
  player_data.url_next = unescape(player_data.url_next);
} else if (player_data.encrypt == "2") {
  player_data.url = unescape(base64decode(player_data.url));
  player_data.url_next = unescape(base64decode(player_data.url_next));
}

Fixes #9159

Template

Before submitting a pull request make sure you have:

• At least skimmed through contributing guidelines including yt-dlp coding conventions
• Searched the bugtracker for similar pull requests
• Checked the code with flake8 and ran relevant tests

In order to be accepted and merged into yt-dlp each piece of code must be in public domain or released under Unlicense. Check all of the following options that apply:

• I am the original author of this code and I am willing to release it under Unlicense
• I am not the original author of this code but it is in public domain or released under Unlicense (provide reliable evidence)

What is the purpose of your pull request?

• Fix or improvement to an extractor (Make sure to add/update tests)
• New extractor (Piracy websites will not be accepted)
• Core bug fix/improvement
• New feature (It is strongly recommended to open an issue first)

[dirkf]

Download tests are failing with 401 from the UK on getting the "m3u8 information": is that expected?

[DmitryScaletta]

They use Cloudflare DDoS Protection now.
Extraction no longer works.
But it works fine with User-Agent header and cf_clearance cookie.

It doesn't work with Cookie from Firefox and User-Agent from Chrome and vice versa.
Looks like User-Agent must match exactly where the cookie was obtained from.
Changing even one character doesn't work.

[coletdjnz]

#7595 may help with that

[bashonly]

I'm still getting 403'd with curl_cffi/curl-impersonate. They may have enabled cloudflare's "I'm Under Attack" mode, where a JS challenge is required no matter what (unless you pass cookies from a session that has already passed the challenge, as Dmitry said)

[seproDev]

No longer has a CF challenge for me

[dirkf]

Yes, the same tests that failed before are passing now.